coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add isolated ops-warden warn pin (FLEX-WP-0016); FLEX-WP-0007 stays finished
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
policy.enabled cannot flip against the user-engine or tenant-engine
bindings. Helm release flex-auth-ops-warden rev 1 serves the production
registry in warn. Workstation warden sends no caller token; enforce and
the yaml flip stay ops-warden's.
This commit is contained in:
tegwick 2026-08-19 14:50:04 +02:00
parent c48c696387
commit 259f8a20a6
6 changed files with 142 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/stage1.sh
View file

@ -7,7 +7,7 @@ cd "$(dirname "${BASH_SOURCE[0]}")/.."
python3 tests/validate_app_toml.py
for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
values/user-engine.yaml values/tenant-engine.yaml; do
values/user-engine.yaml values/tenant-engine.yaml values/ops-warden.yaml; do
echo "helm template ${values}"
helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
done
@ -25,6 +25,14 @@ echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforc
echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \
|| { echo "tenant-engine render omits its exact binding" >&2; exit 1; }
ops_render="$(helm template flex-auth-ops-warden charts/flex-auth -f values/ops-warden.yaml --namespace flex-auth)"
echo "$ops_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn \
|| { echo "ops-warden first pin must be warn" >&2; exit 1; }
echo "$ops_render" | grep -q 'ops-warden=system:serviceaccount:ops-warden:ops-warden' \
|| { echo "ops-warden render omits its exact binding" >&2; exit 1; }
echo "$ops_render" | grep -q production_registry_snapshot.json \
|| { echo "ops-warden render omits the production registry" >&2; exit 1; }
canary_render="$(helm template flex-auth-canary charts/flex-auth -f values/stage2-canary.yaml --namespace flex-auth)"
if echo "$canary_render" | grep -q tokenreviews; then
echo "isolated canary must not create TokenReview RBAC" >&2